// For flags

CVE-2020-3238

Cisco IOx Application Framework Arbitrary File Creation Vulnerability

Severity Score

8.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

A vulnerability in the Cisco Application Framework component of the Cisco IOx application environment could allow an authenticated, remote attacker to write or modify arbitrary files in the virtual instance that is running on the affected device. The vulnerability is due to insufficient input validation of user-supplied application packages. An attacker who can upload a malicious package within Cisco IOx could exploit the vulnerability to modify arbitrary files. The impacts of a successful exploit are limited to the scope of the virtual instance and do not affect the device that is hosting Cisco IOx.

Una vulnerabilidad en el componente Cisco Application Framework del entorno de aplicación Cisco IOx, podría permitir a un atacante remoto autenticado escribir o modificar archivos arbitrarios en la instancia virtual que se ejecuta en el dispositivo afectado. La vulnerabilidad es debido a una comprobación de entrada insuficiente de los paquetes de aplicación suministrados por el usuario. Un atacante que puede cargar un paquete malicioso dentro de Cisco IOx podría explotar la vulnerabilidad para modificar archivos arbitrarios. Los impactos de una explotación con éxito se limitan al alcance de la instancia virtual y no afectan el dispositivo que aloja Cisco IOx.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
None
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2019-12-12 CVE Reserved
  • 2020-06-03 CVE Published
  • 2023-09-05 EPSS Updated
  • 2024-11-15 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
Iox
Search vendor "Cisco" for product "Iox"
< 1.9.0
Search vendor "Cisco" for product "Iox" and version " < 1.9.0"
-
Affected